Fourth-Party Risk Management demo
Every critical service traced through its vendors to the fourth parties it depends on. 1:31
What the demo shows
Maps vendors' subcontractors and flags concentration risk for risk and resilience teams
A discovery agent reads each vendor's SOC report, contract, DPA, trust page and public notices and finds the subcontractors that run the service, citing every passage; a verifier re-reads each link from a second source and puts contradictions to a person. A service mapper links critical services to vendors, and a concentration agent counts how many critical services end at each fourth party and runs outage scenarios against each service's tolerance. A watch agent reads status pages and incident news about fourth parties and lights the map within minutes. The resilience manager accepts a concentration or opens an exit plan, which an exit planner drafts, and a register agent writes the DORA register rows and the audit trail.
Transcript
- Fourth-Party Risk Management maps your vendors' own suppliers and flags dangerous concentration.
- It's for resilience and vendor risk teams, as Dora demands the full subcontracting chain.
- One faulty update in 2024 cost America's largest companies $5.4 billion.
- Agents read SOC reports, contracts and trust pages, and cite every link.
- At 7.18, a Frankfurt cloud region degrades, and the map lights up.
- Seven of 22 critical services are exposed through five different vendors.
- Payroll and the warehouses would run over tolerance, for services would hold.
- Where documents disagree, the verifier puts both to the security architect.
- Tomas accepts one exposure with his signature and opens two exit plans.
- Every value is cited, every decision signed and logged.
- The result, exposure known in minutes with every critical service traced.
- Built on Botminds: agents, data, screens and governance on one platform.
Transcribed from the film’s narration. Captions are on the player.